[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_157":158,"_159":160},"routes/_app.x.$handle.$name",{"_11":12,"_13":14,"_15":16,"_18":19,"_17":-7,"_119":-5,"_20":120,"_22":121,"_122":123,"_124":125,"_25":126,"_24":-5,"_127":-5,"_128":-5,"_129":53,"_130":131,"_132":44,"_133":-5,"_134":-5,"_135":136},"routes/_app.x.$handle.$name.branch.$branch.code.$",{"_11":12,"_13":14,"_15":16,"_17":-7,"_18":19,"_20":21,"_22":23,"_24":-7,"_25":26,"_27":-5,"_28":-5,"_29":-5,"_30":-5,"_31":-5},"handle","apchelkina","name","ulei_task_bot","branchName","main","version","path","","project",{"_33":61,"_13":14,"_45":62,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":70,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":82,"_83":84,"_85":86,"_87":-5,"_88":89,"_90":89,"_91":92,"_93":92,"_94":92,"_95":89,"_96":89,"_97":98,"_99":100,"_101":102,"_103":53},"tree",[56],"file","contents",[32],"upstream","pull","ahead","behind","envVars",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":55},"id","7dc524bb-af03-4246-aa71-2e28d3271c5e","main.ts","fileId","1fd2d5f8-a123-11f1-bdf3-1607ee4eb77e","parentId","branchId","fd96d69f-691a-44ee-b9cd-4cc3e003d808","branchVersion",5,"latest",true,"createdAt",["D",1787735844209],4,"fileType","http","content","// ═══════════════════════════════════════════════════════════════════════\n// Улей HUB — один Telegram-бот на всех + личные кабинеты.\n// Человек открывает бота, регистрируется (логин+пароль). Дальше:\n// • в Telegram — мини-приложение (вход автоматический по Telegram);\n// • на компьютере — по ссылке, вход логином/паролем («запомнить меня»).\n// Сброс/смена пароля — через бота. Админ видит список пользователей.\n//\n// Переменные окружения (Val Town → Environment Variables):\n// BOT_TOKEN — токен бота от @BotFather (обязательно)\n// AUTH_SECRET — длинная случайная строка (подпись сессий, обязательно)\n// ADMIN_ID — ваш Telegram ID (для команды /users и /setup). Желательно.\n// SIGNUP_CODE — (необязательно) код-приглашение для регистрации в боте.\n// После деплоя один раз открой: https://АДРЕС/setup?key=AUTH_SECRET\n// ═══════════════════════════════════════════════════════════════════════\n\nimport { blob } from \"https://esm.town/v/std/blob/main.ts\";\n\nconst BOT_TOKEN = Deno.env.get(\"BOT_TOKEN\") || \"\";\nconst AUTH_SECRET = Deno.env.get(\"AUTH_SECRET\") || \"PLEASE_SET_AUTH_SECRET\";\nconst ADMIN_ID = (Deno.env.get(\"ADMIN_ID\") || \"\").trim();\nconst SIGNUP_CODE = (Deno.env.get(\"SIGNUP_CODE\") || \"\").trim();\nconst WEBHOOK_SECRET =\n (Deno.env.get(\"WEBHOOK_SECRET\") || AUTH_SECRET).replace(/[^A-Za-z0-9_-]/g, \"\")\n .slice(0, 200) || \"uley\";\nconst API = `https://api.telegram.org/bot${BOT_TOKEN}/`;\n\ntype Sub = {\n id: string;\n title: string;\n deadline: string;\n priority: string;\n status: string;\n notes: string;\n};\ntype Proj = {\n id: string;\n createdAt: number;\n title: string;\n desc: string;\n deadline: string;\n priority: string;\n status?: string;\n tags: string[];\n subtasks: Sub[];\n};\ntype Acc = {\n login: string;\n salt: string;\n hash: string;\n tgId: string;\n tgName: string;\n createdAt: number;\n};\n\n// ───────────────────────── crypto ─────────────────────────\nconst enc = new TextEncoder();\nconst toHex = (b: Uint8Array) =>\n Array.from(b).map((x) => x.toString(16).padStart(2, \"0\")).join(\"\");\nconst fromHex = (h: string) =>\n new Uint8Array((h.match(/.{1,2}/g) || []).map((x) => parseInt(x, 16)));\nfunction randHex(n: number) {\n const a = new Uint8Array(n);\n crypto.getRandomValues(a);\n return toHex(a);\n}\nasync function hmacBytes(\n keyBytes: Uint8Array,\n msg: string,\n): Promise {\n const k = await crypto.subtle.importKey(\n \"raw\",\n keyBytes,\n { name: \"HMAC\", hash: \"SHA-256\" },\n false,\n [\"sign\"],\n );\n return new Uint8Array(await crypto.subtle.sign(\"HMAC\", k, enc.encode(msg)));\n}\nasync function hmacHex(secret: string, msg: string): Promise {\n return toHex(await hmacBytes(enc.encode(secret), msg));\n}\nasync function pbkdf2(password: string, saltHex: string): Promise {\n const key = await crypto.subtle.importKey(\n \"raw\",\n enc.encode(password),\n \"PBKDF2\",\n false,\n [\"deriveBits\"],\n );\n const bits = await crypto.subtle.deriveBits(\n {\n name: \"PBKDF2\",\n salt: fromHex(saltHex),\n iterations: 100000,\n hash: \"SHA-256\",\n },\n key,\n 256,\n );\n return toHex(new Uint8Array(bits));\n}\nfunction timingEq(a: string, b: string): boolean {\n if (a.length !== b.length) return false;\n let r = 0;\n for (let i = 0; i < a.length; i++) r |= a.charCodeAt(i) ^ b.charCodeAt(i);\n return r === 0;\n}\n\n// ───────────────────────── storage ─────────────────────────\nconst accKey = (login: string) => \"h_acc_\" + login;\nconst tgKey = (tgId: string | number) => \"h_tg_\" + tgId;\nconst tasksKey = (login: string) => \"h_tsk_\" + login;\nconst pendKey = (chatId: string | number) => \"h_pend_\" + chatId;\nconst INDEX_KEY = \"h_index\";\nconst normLogin = (s: string) => String(s || \"\").trim().toLowerCase();\nconst validLogin = (s: string) => /^[a-z0-9_.-]{3,32}$/.test(s);\n\nasync function getAcc(login: string): Promise {\n try {\n const a = await blob.getJSON(accKey(login));\n return (a && a.login) ? a as Acc : null;\n } catch (_e) {\n return null;\n }\n}\nasync function setAcc(a: Acc) {\n await blob.setJSON(accKey(a.login), a);\n}\nasync function loginByTg(tgId: string | number): Promise {\n try {\n const l = await blob.getJSON(tgKey(tgId));\n return (typeof l === \"string\") ? l : null;\n } catch (_e) {\n return null;\n }\n}\nasync function getIndex(): Promise {\n try {\n const i = await blob.getJSON(INDEX_KEY);\n return Array.isArray(i) ? i : [];\n } catch (_e) {\n return [];\n }\n}\nasync function addToIndex(a: Acc) {\n const idx = await getIndex();\n idx.push({\n login: a.login,\n tgId: a.tgId,\n tgName: a.tgName,\n createdAt: a.createdAt,\n });\n await blob.setJSON(INDEX_KEY, idx);\n}\nasync function getTasks(\n login: string,\n): Promise<{ v: number; projects: Proj[] }> {\n try {\n const t = await blob.getJSON(tasksKey(login));\n if (t && Array.isArray(t.projects)) return t as any;\n } catch (_e) { /**/ }\n return { v: 1, projects: [] };\n}\nasync function setTasks(login: string, projects: Proj[]) {\n await blob.setJSON(tasksKey(login), { v: 1, projects });\n}\nasync function getPending(chatId: string | number): Promise {\n try {\n const p = await blob.getJSON(pendKey(chatId));\n if (p && p.ts && (Date.now() - p.ts) < 900000) return p;\n } catch (_e) { /**/ }\n return null;\n}\nasync function setPending(chatId: string | number, d: any) {\n await blob.setJSON(pendKey(chatId), { ...d, ts: Date.now() });\n}\nasync function delPending(chatId: string | number) {\n try {\n await blob.delete(pendKey(chatId));\n } catch (_e) { /**/ }\n}\n\nasync function createAccount(\n login: string,\n password: string,\n tgId: string,\n tgName: string,\n): Promise {\n const salt = randHex(16);\n const acc: Acc = {\n login,\n salt,\n hash: await pbkdf2(password, salt),\n tgId,\n tgName,\n createdAt: Date.now(),\n };\n await setAcc(acc);\n await blob.setJSON(tgKey(tgId), login);\n await setTasks(login, []);\n await addToIndex(acc);\n return acc;\n}\nasync function setPassword(acc: Acc, newPassword: string) {\n acc.salt = randHex(16);\n acc.hash = await pbkdf2(newPassword, acc.salt);\n await setAcc(acc);\n}\n\n// ───────────────────────── sessions ─────────────────────────\nasync function makeToken(login: string): Promise {\n return login + \".\" + (await hmacHex(AUTH_SECRET, \"uley:\" + login));\n}\nasync function verifyToken(tok: string): Promise {\n const i = tok.lastIndexOf(\".\");\n if (i < 1) return null;\n const login = tok.slice(0, i), sig = tok.slice(i + 1);\n return timingEq(sig, await hmacHex(AUTH_SECRET, \"uley:\" + login))\n ? login\n : null;\n}\nfunction readCookie(req: Request, name: string): string | null {\n const c = req.headers.get(\"cookie\");\n if (!c) return null;\n for (const part of c.split(\";\")) {\n const [k, ...v] = part.trim().split(\"=\");\n if (k === name) return decodeURIComponent(v.join(\"=\"));\n }\n return null;\n}\nasync function currentLogin(req: Request): Promise {\n const t = readCookie(req, \"sid\");\n return t ? await verifyToken(t) : null;\n}\nfunction sessionCookie(tok: string, remember: boolean): string {\n const base = `sid=${\n encodeURIComponent(tok)\n }; Path=/; HttpOnly; Secure; SameSite=Lax`;\n return remember ? base + \"; Max-Age=31536000\" : base;\n}\nconst clearCookie = \"sid=; Path=/; HttpOnly; Secure; SameSite=Lax; Max-Age=0\";\n\n// ───────────────────────── Telegram initData verify ─────────────────────────\nasync function verifyInitData(\n initData: string,\n): Promise<{ id: string; name: string } | null> {\n if (!initData) return null;\n const params = new URLSearchParams(initData);\n const hash = params.get(\"hash\");\n if (!hash) return null;\n const pairs: string[] = [];\n for (const [k, v] of params) if (k !== \"hash\") pairs.push(k + \"=\" + v);\n pairs.sort();\n const dcs = pairs.join(\"\\n\");\n const secret = await hmacBytes(enc.encode(\"WebAppData\"), BOT_TOKEN);\n const check = toHex(await hmacBytes(secret, dcs));\n if (!timingEq(check, hash)) return null;\n const authDate = Number(params.get(\"auth_date\") || \"0\");\n if (authDate && (Date.now() / 1000 - authDate) > 60 * 60 * 24 * 30) {\n return null; // 30 дней\n }\n try {\n const u = JSON.parse(params.get(\"user\") || \"{}\");\n if (!u.id) return null;\n const name = u.username\n ? \"@\" + u.username\n : [u.first_name, u.last_name].filter(Boolean).join(\" \");\n return { id: String(u.id), name: name || String(u.id) };\n } catch (_e) {\n return null;\n }\n}\n\n// ───────────────────────── Telegram API + bot ─────────────────────────\nasync function tg(method: string, params: Record) {\n try {\n const r = await fetch(API + method, {\n method: \"POST\",\n headers: { \"Content-Type\": \"application/json\" },\n body: JSON.stringify(params),\n });\n return await r.json();\n } catch (_e) {\n return null;\n }\n}\nfunction appButton(base: string) {\n return { text: \"🗂 Открыть трекер\", web_app: { url: base + \"/\" } };\n}\nfunction welcomeKb(base: string, login: string) {\n return {\n inline_keyboard: [[appButton(base)], [{\n text: \"💻 Ссылка для компьютера\",\n callback_data: \"web\",\n }], [{ text: \"🔑 Сменить пароль\", callback_data: \"pw\" }]],\n };\n}\n\nasync function handleUpdate(u: any, base: string) {\n if (u.callback_query) {\n const cq = u.callback_query;\n const chatId = cq.message?.chat?.id;\n const from = String(cq.from?.id || \"\");\n const data = cq.data || \"\";\n const login = await loginByTg(from);\n if (data === \"web\") {\n await tg(\"answerCallbackQuery\", { callback_query_id: cq.id });\n if (!login) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Сначала зарегистрируйтесь: /start\",\n });\n return;\n }\n await tg(\"sendMessage\", {\n chat_id: chatId,\n parse_mode: \"HTML\",\n text:\n `💻 Открой на компьютере: ${base}\\nВойди своим логином ${\n escHtml(login)\n } и паролем. Поставь галочку «Запомнить меня» — и больше вводить не придётся.`,\n });\n return;\n }\n if (data === \"pw\") {\n await tg(\"answerCallbackQuery\", { callback_query_id: cq.id });\n if (!login) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Сначала зарегистрируйтесь: /start\",\n });\n return;\n }\n await setPending(chatId, { stage: \"newpass\", login });\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"🔑 Пришлите новый пароль (минимум 6 символов). Это же — способ восстановить пароль, если забыли.\",\n });\n return;\n }\n await tg(\"answerCallbackQuery\", { callback_query_id: cq.id });\n return;\n }\n\n const msg = u.message;\n if (!msg || !msg.text) return;\n const chatId = msg.chat.id;\n const from = String(msg.from?.id || \"\");\n const text = String(msg.text).trim();\n const existing = await loginByTg(from);\n\n if (text === \"/start\") {\n await delPending(chatId);\n if (existing) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n parse_mode: \"HTML\",\n text: `С возвращением! Ваш логин: ${\n escHtml(existing)\n }.\\n\\nОткрывайте трекер кнопкой ниже — на телефоне вход автоматический. Для компьютера — «Ссылка для компьютера».`,\n reply_markup: welcomeKb(base, existing),\n });\n return;\n }\n if (SIGNUP_CODE) {\n await setPending(chatId, { stage: \"code\" });\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"👋 Это трекер задач «Улей». Введите код приглашения, чтобы зарегистрироваться.\",\n });\n return;\n }\n await setPending(chatId, { stage: \"login\" });\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"👋 Это трекер задач «Улей». Давайте создадим кабинет.\\n\\nПридумайте ЛОГИН (латиница, цифры, . _ - ; 3–32 символа):\",\n });\n return;\n }\n if (text === \"/help\") {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n parse_mode: \"HTML\",\n text:\n \"«Улей» — трекер задач.\\n/start — начать / открыть трекер\\nКнопка «Открыть трекер» — приложение (на телефоне вход автоматический).\\n«Сменить пароль» — там же задать/восстановить пароль для входа с компьютера.\",\n });\n return;\n }\n if (text === \"/password\" || text === \"/reset\") {\n if (!existing) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Сначала зарегистрируйтесь: /start\",\n });\n return;\n }\n await setPending(chatId, { stage: \"newpass\", login: existing });\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"🔑 Пришлите новый пароль (минимум 6 символов).\",\n });\n return;\n }\n if (text === \"/users\") {\n if (!ADMIN_ID || from !== ADMIN_ID) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Команда только для админа.\",\n });\n return;\n }\n const idx = await getIndex();\n const lines = idx.map((u2: any, i: number) =>\n `${i + 1}. ${escHtml(u2.login)}${\n u2.tgName ? \" — \" + escHtml(u2.tgName) : \"\"\n }`\n );\n await tg(\"sendMessage\", {\n chat_id: chatId,\n parse_mode: \"HTML\",\n text: `Зарегистрировано: ${idx.length}\\n\\n${\n lines.join(\"\\n\") || \"пока никого\"\n }`,\n });\n return;\n }\n\n // pending flows\n const pend = await getPending(chatId);\n if (pend) {\n if (pend.stage === \"code\") {\n if (text !== SIGNUP_CODE) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"Неверный код. Попробуйте ещё раз или напишите тому, кто дал ссылку.\",\n });\n return;\n }\n await setPending(chatId, { stage: \"login\" });\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"Отлично! Придумайте ЛОГИН (латиница, цифры, . _ - ; 3–32 символа):\",\n });\n return;\n }\n if (pend.stage === \"login\") {\n const login = normLogin(text);\n if (!validLogin(login)) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"Логин: 3–32 символа, только латиница, цифры и . _ - . Попробуйте другой:\",\n });\n return;\n }\n if (await getAcc(login)) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Такой логин занят. Придумайте другой:\",\n });\n return;\n }\n await setPending(chatId, { stage: \"pass\", login });\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n `Логин «${login}» свободен. Теперь придумайте ПАРОЛЬ (минимум 6 символов).\\n(Это сообщение с паролем потом можно удалить.)`,\n });\n return;\n }\n if (pend.stage === \"pass\") {\n if (text.length < 6) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Пароль минимум 6 символов. Попробуйте ещё раз:\",\n });\n return;\n }\n const tgName = msg.from?.username\n ? \"@\" + msg.from.username\n : [msg.from?.first_name, msg.from?.last_name].filter(Boolean).join(\" \");\n await createAccount(pend.login, text, from, tgName || \"\");\n await delPending(chatId);\n await tg(\"sendMessage\", {\n chat_id: chatId,\n parse_mode: \"HTML\",\n text: `✅ Кабинет создан! Логин: ${\n escHtml(pend.login)\n }.\\n\\nОткрывайте трекер кнопкой ниже. На телефоне вход автоматический; для компьютера — кнопка «Ссылка для компьютера».`,\n reply_markup: welcomeKb(base, pend.login),\n });\n return;\n }\n if (pend.stage === \"newpass\") {\n if (text.length < 6) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Пароль минимум 6 символов. Попробуйте ещё раз:\",\n });\n return;\n }\n const acc = await getAcc(pend.login);\n if (acc) await setPassword(acc, text);\n await delPending(chatId);\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text:\n \"✅ Пароль обновлён. Теперь входите с ним на компьютере (галочка «Запомнить меня»).\",\n });\n return;\n }\n }\n\n // fallback\n if (existing) {\n await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Открывайте трекер: /start\",\n reply_markup: welcomeKb(base, existing),\n });\n } else {await tg(\"sendMessage\", {\n chat_id: chatId,\n text: \"Напишите /start, чтобы создать кабинет.\",\n });}\n}\n\nconst escHtml = (s: string) =>\n String(s ?? \"\").replace(\n /[<>&]/g,\n (c) => ({ \"<\": \"<\", \">\": \">\", \"&\": \"&\" }[c]!),\n );\n\n// ───────────────────────── HTTP ─────────────────────────\nconst WEBAPP_HTML =\n \"\\n\\n\\n\\n\\n\\n\\n\\n\\nУлей\\n\\n\\n\\n\\n\\n\\n

\\n

\\n \\n

\\n

Улей

\\n

Задачи · подзадачи · дедлайны

\\n

\\n \\n \\n

\\n\\n \\n\\n \\n

\\n\\n \\n

\\n

\\n\\n

Сохранение…

\\n\\n

\\n

\\n\\n\\n\\n\\n\\n\";\nconst json = (o: unknown, status = 200, extra: Record = {}) =>\n new Response(JSON.stringify(o), {\n status,\n headers: { \"content-type\": \"application/json; charset=utf-8\", ...extra },\n });\n\nexport default async function (req: Request): Promise {\n const url = new URL(req.url);\n const base = url.origin;\n const path = url.pathname;\n\n if (path === \"/\" || path === \"\") {\n return new Response(WEBAPP_HTML, {\n headers: { \"content-type\": \"text/html; charset=utf-8\" },\n });\n }\n if (path === \"/health\") return new Response(\"ok\");\n if (path === \"/favicon.ico\") {\n return new Response(\n '',\n { headers: { \"content-type\": \"image/svg+xml\" } },\n );\n }\n\n // Telegram Mini App auto-login\n if (path === \"/api/tg-auth\" && req.method === \"POST\") {\n let b: any;\n try {\n b = await req.json();\n } catch (_e) {\n return json({ error: \"bad\" }, 400);\n }\n const info = await verifyInitData(String(b.initData || \"\"));\n if (!info) return json({ error: \"bad_initdata\" }, 401);\n const login = await loginByTg(info.id);\n if (!login) return json({ error: \"not_registered\" }, 409);\n return json({ login }, 200, {\n \"Set-Cookie\": sessionCookie(await makeToken(login), true),\n });\n }\n // web login\n if (path === \"/api/login\" && req.method === \"POST\") {\n let b: any;\n try {\n b = await req.json();\n } catch (_e) {\n return json({ error: \"bad\" }, 400);\n }\n const login = normLogin(b.login);\n const acc = await getAcc(login);\n if (!acc) return json({ error: \"Неверный логин или пароль\" }, 401);\n if (!timingEq(await pbkdf2(String(b.password || \"\"), acc.salt), acc.hash)) {\n return json({ error: \"Неверный логин или пароль\" }, 401);\n }\n return json({ login }, 200, {\n \"Set-Cookie\": sessionCookie(await makeToken(login), b.remember !== false),\n });\n }\n if (path === \"/api/logout\" && req.method === \"POST\") {\n return json({ ok: true }, 200, { \"Set-Cookie\": clearCookie });\n }\n if (path === \"/api/me\") {\n const login = await currentLogin(req);\n return login ? json({ login }) : json({ error: \"unauthorized\" }, 401);\n }\n // change password (web, requires old)\n if (path === \"/api/password\" && req.method === \"POST\") {\n const login = await currentLogin(req);\n if (!login) return json({ error: \"unauthorized\" }, 401);\n let b: any;\n try {\n b = await req.json();\n } catch (_e) {\n return json({ error: \"bad\" }, 400);\n }\n const acc = await getAcc(login);\n if (!acc) return json({ error: \"unauthorized\" }, 401);\n if (\n !timingEq(await pbkdf2(String(b.oldPassword || \"\"), acc.salt), acc.hash)\n ) return json({ error: \"Текущий пароль неверный\" }, 403);\n if (String(b.newPassword || \"\").length < 6) {\n return json({ error: \"Новый пароль минимум 6 символов\" }, 400);\n }\n await setPassword(acc, String(b.newPassword));\n return json({ ok: true });\n }\n // tasks\n if (path === \"/api/tasks\") {\n const login = await currentLogin(req);\n if (!login) return json({ error: \"unauthorized\" }, 401);\n if (req.method === \"GET\") return json(await getTasks(login));\n if (req.method === \"POST\") {\n try {\n const body = await req.json();\n if (!body || !Array.isArray(body.projects)) {\n return json({ error: \"bad\" }, 400);\n }\n await setTasks(login, body.projects);\n return json({ ok: true });\n } catch (_e) {\n return json({ error: \"bad\" }, 400);\n }\n }\n return json({ error: \"method\" }, 405);\n }\n\n // Telegram webhook\n if (path === \"/bot\") {\n if (req.method !== \"POST\") return new Response(\"ok\");\n if (req.headers.get(\"X-Telegram-Bot-Api-Secret-Token\") !== WEBHOOK_SECRET) {\n return new Response(\"forbidden\", { status: 403 });\n }\n let update: unknown;\n try {\n update = await req.json();\n } catch (_e) {\n return new Response(\"ok\");\n }\n try {\n await handleUpdate(update, base);\n } catch (e) {\n console.error(\"upd\", e);\n }\n return new Response(\"ok\");\n }\n // one-time setup (admin)\n if (path === \"/setup\") {\n if (url.searchParams.get(\"key\") !== AUTH_SECRET) {\n return new Response(\"Добавьте ?key=ВАШ_AUTH_SECRET\", { status: 401 });\n }\n if (!BOT_TOKEN) return new Response(\"Не задан BOT_TOKEN\", { status: 400 });\n const wh = await tg(\"setWebhook\", {\n url: base + \"/bot\",\n secret_token: WEBHOOK_SECRET,\n allowed_updates: [\"message\", \"callback_query\"],\n drop_pending_updates: true,\n });\n // Кнопка меню = мини-приложение для ВСЕХ (безопасно: вход у каждого свой, по Telegram-подписи)\n await tg(\"setChatMenuButton\", {\n menu_button: {\n type: \"web_app\",\n text: \"Трекер\",\n web_app: { url: base + \"/\" },\n },\n });\n await tg(\"setMyCommands\", {\n commands: [\n { command: \"start\", description: \"Открыть трекер / регистрация\" },\n { command: \"password\", description: \"Сменить пароль\" },\n { command: \"help\", description: \"Помощь\" },\n ],\n });\n const me = await tg(\"getMe\", {});\n return json({\n webhook: wh,\n bot: me?.result?.username ? \"@\" + me.result.username : me,\n });\n }\n\n return new Response(\"Not found\", { status: 404 });\n}","deleted",false,"label",[35],{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":59,"_18":60},["D",1787735844209],"children",[],[35],"62b11783-b8ca-497d-a557-635e3d10bb2f",["D",1787730765458],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","imageUrl","https://imagedelivery.net/iHX6Ovru0O7AjmyT5yZRoA/1ceff5a6-ef6a-41e6-c6fe-80757d63c901/square512?exp=1789567199&sig=5116dd6f86bd6c98b4c57cb89e730bbe11e07a965b161e668dc981591de5bf60","userId","d6451c8b-f6de-4804-8dd9-f0e722b58f3c","pinnedFileId","pinPreview","pinMigrated","screenshotVersion","likeCount",0,"orgId","01a02e34-ed6f-76c9-b08c-20c23ba01292","tursoName","62b11783b8ca497da557635e3d10bb2f","tursoHostname","62b11783b8ca497da557635e3d10bb2f-val-town.aws-us-east-2.turso.io","tursoMeasuredAt",["D",1789475460618],"pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_11":12,"_118":114},"org",{"_11":12,"_112":12,"_113":114,"_71":72,"_115":116,"_117":53},"branch",{"_17":42,"_13":16,"_33":40,"_104":61,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"isOwned","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","displayName","avatar","https://avatars.githubusercontent.com/u/288573541?v=4","tier","free","canRestrictVals","profileImageUrl","adoptOrgId",{"_33":61,"_13":14,"_45":152,"_63":-5,"_64":53,"_65":66,"_67":66,"_68":19,"_69":70,"_71":72,"_73":37,"_74":44,"_75":-5,"_76":-5,"_77":78,"_79":80,"_81":82,"_83":84,"_85":153,"_87":-5,"_88":89,"_90":89,"_91":92,"_93":92,"_94":92,"_95":89,"_96":89,"_97":154,"_99":155,"_101":156,"_103":53},[149],"files",[149],"counts",{"_139":78,"_140":141,"_142":78,"_31":143,"_144":145},[137],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":46,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_18":138},[35],"pulls","branches",1,"forks",{"_146":42,"_148":78},"connections",{"_146":78,"_147":78},"count","unfilledCount","emptyCount",{"_33":34,"_13":35,"_36":37,"_38":-5,"_39":40,"_41":42,"_43":44,"_45":57,"_17":47,"_48":49,"_50":51,"_52":53,"_54":-5,"_58":150,"_18":151},[],[35],["D",1787730765458],["D",1789475460618],{"_11":12,"_118":114},{"_11":12,"_112":12,"_113":114,"_71":72,"_115":116,"_117":53},{"_17":42,"_13":16,"_33":40,"_104":61,"_105":-5,"_106":-5,"_107":-5,"_108":-5,"_109":-5,"_110":14,"_111":12},"ctx",{"_97":-5,"_134":190,"_191":192,"_193":194,"_195":53,"_196":53,"_197":53,"_198":44,"_199":-5,"_200":-7,"_201":-7,"_202":78,"_203":53,"_204":53,"_205":-5,"_206":53,"_207":53,"_208":53,"_209":-5},"ENV",{"_161":162,"_163":164,"_165":16,"_166":167,"_168":169,"_170":171,"_172":173,"_174":175,"_176":177,"_178":179,"_180":181,"_182":183,"_184":185,"_186":187,"_188":189},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]